Merge tag 'v1.5.2', bringing security fixes

diff --cc config.mk
Simple merge

diff --cc lib/dnssec/nsec.c
Simple merge

diff --cc lib/dnssec/nsec3.c
index 1ebf3850ebe68baec0e170e4d23b8b2a8d3645d1,898eaec8cc90834767831e0ef75ee0a12080fc35..fd683cb6171ee898e246fb4c100ce61d4bbd5ddc
--- 1/lib/dnssec/nsec3.c
--- 2/lib/dnssec/nsec3.c
+++ b/lib/dnssec/nsec3.c
@@@ -746,10 -692,8 +689,9 @@@ int kr_nsec3_ref_to_unsigned(const knot
                if (ns->type != KNOT_RRTYPE_NS) {
                        continue;
                }
 +
 +              int flags = 0;
                bool nsec3_found = false;
- 
 -              flags = 0;
                for (unsigned j = 0; j < sec->count; ++j) {
                        const knot_rrset_t *nsec3 = knot_pkt_rr(sec, j);
                        if (nsec3->type == KNOT_RRTYPE_DS) {
@@@ -759,22 -703,11 +701,14 @@@
                                continue;
                        }
                        nsec3_found = true;
-                       /* nsec3 found, check if owner name matches
-                        * the delegation name
-                        */
-                       int ret = matches_name(&flags, nsec3, ns->owner);
-                       if (ret != 0) {
-                               return kr_error(EINVAL);
-                       }
-                       if (!(flags & FLG_NAME_MATCHED)) {
-                               /* nsec3 owner name does not match
-                                * the delegation name
-                                */
+                       /* nsec3 found, check if owner name matches the delegation name.
+                        * Just skip in case of *any* errors. */
+                       if (matches_name(nsec3, ns->owner) != kr_ok()) {
                                continue;
                        }
 +
 +                      uint8_t *bm = NULL;
 +                      uint16_t bm_size = 0;
                        knot_nsec3_bitmap(&nsec3->rrs, 0, &bm, &bm_size);
                        if (!bm) {
                                return kr_error(EINVAL);